Trojanised Agent Package Advisory Came 72 Days Late, With Unserved Fix

A critical advisory for the pip package pantheon-agents was published to the GitHub Advisory Database on 26 August at 14:36 UTC. The underlying incident happened in June 2026. The gap between those two dates is 72 days, and it is the least of the problems with this record.

What the attackers did

The maintainer's PyPI account was compromised in a supply-chain attack and versions 0.6.1 and 0.6.2 were uploaded directly to PyPI. Those releases contain a .pth file — a mechanism Python executes automatically at interpreter startup, before any of your code runs — which downloads a JavaScript runtime and harvests environment variables, API keys, SSH keys and cloud credentials. Importing the package was never required. Installing it into an environment that later started Python was sufficient.

The clean part

The advisory is precise about scope: "Only the PyPI artifacts are affected. The GitHub source repository, its git tags, and all other distribution channels are clean." Anyone who vendored from source or pinned a git tag was never exposed. This is a distribution compromise, not a code compromise, which is exactly the case that hash-pinned lockfiles are supposed to catch and that loose version ranges do not.

What the common framing gets wrong

An advisory with a patched version field reading 0.6.4 tells every scanner and every dependency bot the same thing: upgrade to 0.6.4 and you are clear. The body of the same advisory says PyPI distribution is suspended and "will resume after account recovery and migration to PyPI Trusted Publishing (OIDC)," and directs users to install from GitHub source instead. So the machine-readable remediation points at a release the registry is not serving, while the human-readable remediation says to stop using the registry. Automated tooling reads the first field and not the second. A team that lets its bots act on this advisory will open a pull request that cannot resolve.

And there is no CVE

The record carries no CVE identifier. Organisations whose vulnerability management keys on CVE — which is most organisations with a formal process — will not see this at all. A critical credential-stealing compromise of an AI agent framework is therefore visible only to tooling that ingests GitHub advisories directly, 72 days after the fact, with a remediation field pointing somewhere the package cannot be fetched from.

The exposure window is what to audit

The malicious artifacts are gone from PyPI, so the practical question is not whether you can still install them but whether you did between June and their removal. Any CI runner or developer machine that resolved pantheon-agents 0.6.1 or 0.6.2 in that period should be treated as having had its environment variables and cloud credentials read. Rotation, not upgrade, is the remediation.